antifox ai: The Open-Source Pentest Agent Now Stealing AWS Credentials

antifox ai is the second agentic attack framework to make security headlines in a single week. Arctic Wolf Labs has tied infrastructure hosting the open-source penetration testing platform to real intrusions against internet-facing web services and AWS environments, including credential theft and unauthorized access to production secrets. The disclosure lands days after Microsoft Threat Intelligence reported attackers using ARTEX, the framework AntiFox is built on, to find exposed credentials on GitHub. Source

What AntiFox is

AntiFox is an AI-driven autonomous penetration testing platform distributed on GitHub, built on top of ARTEX. Its README describes a planner, worker, and main-agent multi-agent system that runs a full engagement over a dual-graph core, a global asset graph plus a per-task exploration graph: recon, attack-surface discovery, exploitation, finding capture, and report delivery. As of this writing the repository has been forked 251 times and starred 474 times. Source

The project's own documentation puts its weight on delivery rather than discovery. The v2.0 release records every exploitation step, including requests, responses, expected results, and verification conclusions, directly into a database as the agent works. Findings are presented as full exploit chains from entry point to completion, every agent request is captured through an MITM proxy and automatically linked to the relevant step, and the platform generates human-grade .docx reports in Simplified Chinese, Traditional Chinese, and English. Deployment is a single docker compose command that pulls the image and PostgreSQL, exposes a web interface on port 8787, and asks for an Anthropic or OpenAI API key to drive the agents. Source

Nothing in that description requires malice. The same autonomy that makes AntiFox a fast pentest tool for an authorized engagement makes it a fast intrusion tool when someone points it at systems they do not own, and that is exactly what Arctic Wolf says is happening. Source

What Arctic Wolf observed

In a report shared with The Hacker News, Arctic Wolf Labs said that in several recently observed intrusions, Alibaba Cloud systems hosting AntiFox interfaces were associated with confirmed malicious actions against internet-facing web services and associated AWS environments. The activity chains web exploitation and web shell deployment into configuration discovery, credential validation, cloud-service enumeration, secret access, and storage operations. Source

One documented intrusion started with a compromised internet-facing IIS application. Commands running through w3wp.exe, the IIS worker process, identified the execution context with whoami, checked permissions with icacls, tested write access to the web root, and created an ASPX web shell. From there the attackers ran PowerShell to locate web.config files and configuration backups, read application settings and database connection strings, enumerated debug and error-log directories, attempted to connect to an internal production database using a credential pulled from the application configuration, and staged copied configuration and log files in a web-accessible upload directory. The precise vulnerability that achieved the initial code execution is not known. Source

In other attacks the actor started with a valid AWS credential obtained through undetermined means. According to GitGuardian's analysis of the same campaign, one intrusion generated hundreds of AWS API requests in approximately 30 minutes, abusing valid IAM identities to validate credentials and enumerate dozens of services, including IAM, EC2, S3, Lambda, Secrets Manager, KMS, RDS, ECS, EKS, Redshift, Athena, Glue, Systems Manager, API Gateway, CloudWatch, CloudFormation, DynamoDB, and Amazon Bedrock. Most of those authenticated requests were denied, but some succeeded, including a GetSecretValue call against a production secret, and in a separate incident a valid identity was used for S3 discovery and object operations. Source

What Check Point found inside the consoles

AntiFox is a fork of ARTEX, and Check Point Research's November 5 report on ARTEX gives the clearest public picture of how these agent fleets are actually operated. Check Point found 2,557 systems that hosted or had hosted ARTEX panels, with 1,608 live and publicly reachable instances at the time of research. Ten instances were misconfigured to expose their full databases, which let researchers see exactly how operators prompted their agents and which models drove them. Source

The headline finding is how little the operators do. Beyond setting the initial goal, the agents ran fully autonomously; human interaction was largely limited to checking progress, asking whether a target had been compromised, or occasionally adjusting priorities. Chinese models dominated the configured LLMs, with the Deepseek Flash family most prevalent. On three instances where American models were configured, Check Point observed guardrails being hit only with Anthropic's Opus 5.5, after which the actor switched to more permissive Chinese models. Source

The campaigns Check Point reconstructed are financially motivated and broad. One operator tasked agents with penetrating 292 crypto payment infrastructure domains to drain USDT and plant backdoored receiver addresses; the console ran four days, consumed 167.5 million tokens at an estimated cost of $145 to $300, produced 230 findings and 400,791 agent messages, and netted zero dollars, partly because agents reported successful exploitation based on API responses saying "success" when nothing had actually moved. Another campaign stole gaming credentials at scale for the gray market in hijacked accounts. A third hunted Apple enterprise code-signing certificates. In one case agents discovered an unauthenticated API leaking AWS S3 credentials, reasoned their way into a supply chain attack on a bucket serving 714 iOS enterprise-signed landing pages, and rewrote a manifest file before the bucket owners restored it. Source

ARTEX itself went closed-source on October 8 after the tool was observed in attacks against South Korean banks, but maintained forks and backups keep it publicly available, and AntiFox is the most visible of them. Separate telemetry cited by The Hacker News puts 1,465 hosts running an exposed ARTEX console as of November 4, most in the US, Hong Kong, China, Japan, Singapore, and South Korea, though not every instance is necessarily malicious. Source

Why the credential layer is the weak point

GitGuardian's write-up of the AntiFox campaign makes the point that matters most for defenders: these frameworks do not need exotic capability to do damage, because the credentials are already there. In its testing, only 4 of roughly 45 agentic attack frameworks ship a dedicated secrets scanner, yet an ARTEX build with no scanner at all still found 8 of 9 planted credentials, starting in under 13 seconds. The agent gets a shell and web access and assembles the pipeline at runtime; a GitHub search, a scanner download, and a found key passed to the next call are all one prompt away. Source

The blast radius then depends entirely on permissions. Arctic Wolf's intrusion data shows the same sequence every time: obtain or use a credential, examine what that identity can do, and reach for more resources. A compromised application identity with permission to read a vault yields more secrets, which yield databases and storage. Deleting a leaked key fixes nothing because the access lives on until it is revoked. Source

What to do about it

GitGuardian's recommended emergency response is prevent, detect, remediate, and the specifics map directly to the AntiFox intrusions. Detect what is already exposed: audit public GitHub exposure tied to your developers, scan internal repositories and CI/CD environments for hardcoded secrets, and check developer machines, where credentials accumulate in local config files and AI coding tool directories. Remediate fast: treat exposed credentials as compromised, revoke and rotate them, and prioritize anything that touches production. For AWS specifically, review CloudTrail for successful API calls sitting inside bursts of denied requests, investigate whether compromised identities reached Secrets Manager, revoke affected sessions and access keys, and map dependencies before rotating credentials that production applications depend on. Source

Our read, and this is our assessment rather than any source's claim: the durable defense is the same least-privilege discipline that protects against every other agentic threat, human or machine. An identity that can only reach what it needs caps the value of stealing it, which is the argument we laid out in least-privilege for AI agents. The threat categories in the OWASP agentic AI top 10 now have live incident data behind them, and teams that want a concrete starting point can work through our AI agent security checklist with these campaigns in mind. Check Point's console data also carries a warning for anyone evaluating these tools defensively: run them isolated, scope their keys tightly, and never expose the panel to the internet, because 1,608 live public instances show how often that advice is ignored. Source